opensearch-dashboards-3: bump to v3.3, follow tags for future updates, remediate GHSA-w48q-cv73-mx4w

[ca-scribner]

Bumps the opensearch-dashboards-3 package to v3.3 manually because upstream forgot to actually publish a Github release. The Opensearch blog post for release confirms the product was released, and we see a proper release issued for Opensearch itself.

As this is the second time in 6 months the Opensearch Dashboard has missed publishing a release, and because they've always cut tags accurately, we also set our automation to follow their tags for future updates.

Also remediates GHSA-w48q-cv73-mx4w, which was previously remediated for opensearch-dashboards-2. This is bundled together with the package version bump as we know the CVE will exist.

[octo-sts]

🩹 Build Failed: Patch Application Failed

Hunk #1 FAILED at 127. 1 out of 1 hunk FAILED -- saving rejects to file package.json.rej

Build Details

Category	Details
Build System	melange
Failure Point	patch step during package build pipeline

Root Cause Analysis 🔍

The patch CVE-2025-9287-fix.patch failed to apply to the package.json file. Hunk #1 of the patch could not be applied at line 127, indicating that the target code in package.json has changed from what the patch expects, making the patch incompatible with the current version of the OpenSearch-Dashboards source code at tag 3.3.0.

---

🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Suggested Changes

File: opensearch-dashboards-3.yaml

• remove (patch step)
  Original:

  - uses: patch
    with:
      patches: CVE-2025-9287-fix.patch

Content:

Remove the patch step that applies CVE-2025-9287-fix.patch since it's incompatible with the current version

• add (after line with cipher-base dependency addition)
  Original:

      # fix CVE-2025-9287
      devDependencies='{"cipher-base": "^1.0.5"}'
      jq --argjson devDependencies "$devDependencies" '.devDependencies += $devDependencies' package.json > temp.json && mv temp.json package.json

Replacement:

      # fix CVE-2025-9287
      resolutions='{"cipher-base": "^1.0.5"}'
      jq --argjson resolutions "$resolutions" '.resolutions += $resolutions' package.json > temp.json && mv temp.json package.json

Content:

Replace the devDependencies approach with resolutions to ensure cipher-base version is enforced across all dependency trees

File: CVE-2025-9287-fix.patch

• delete
  Content:

Delete the entire CVE-2025-9287-fix.patch file since it's incompatible with OpenSearch-Dashboards 3.3.0

Click to expand fix analysis

Analysis

The similar fixes all follow a consistent pattern: when patches fail to apply due to version changes, the solution is to replace the incompatible patch with a new one that works with the current version, or to directly modify the package.json using inline JSON manipulation. All three examples removed failed patches (CVE-2025-7783-fix.patch, 2025-07-23-CVEs.patch) and replaced them with either new compatible patches or direct package.json modifications using jq commands. The fixes updated package versions, changed expected commits, and used runtime dependency resolution rather than patches when the source code had changed significantly.

Click to expand fix explanation

Explanation

This fix should work because it follows the exact pattern used in all similar failures. The root cause is that CVE-2025-9287-fix.patch was created for a different version of OpenSearch-Dashboards and the package.json structure has changed at line 127. Instead of trying to fix the patch, we remove it entirely and use the existing inline jq approach that's already being used successfully for other CVE fixes in the same file. The change from devDependencies to resolutions is important because resolutions provides stronger version enforcement across the entire dependency tree, which is more appropriate for security fixes. This approach is already proven to work in the build pipeline since similar CVE fixes are applied using the same method.

Click to expand alternative approaches

Alternative Approaches

• Update the CVE-2025-9287-fix.patch to match the current package.json structure at line 127, but this requires manual inspection of the current file structure
• Upgrade to a newer version of OpenSearch-Dashboards where the patch might be compatible, but this could introduce other breaking changes
• Apply the cipher-base fix as a direct dependency rather than devDependencies or resolutions, but this might not provide adequate security coverage across transitive dependencies

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[powersj]

Removing sustaining from reviewer!